1. Field of Invention
The present invention relates generally to web application security systems, and more particularly, to using application behavior to generate exception rules to allow legitimate messages to pass through application proxies and gateways.
2. Background of the Invention
Corporations are rapidly deploying web-based applications to automate business processes and to facilitate real-time interaction with customers, business partners and employees. Highly vulnerable to malicious hackers, web applications provide an entry point through which sensitive data can be accessed and stolen. Given the vulnerability of web applications, establishing a web application protection is critical for any enterprise that is exposing sensitive data or transaction systems over the Internet.
Firewalls are an essential component in a corporate entity's network security plan. They represent a security enforcement point that separates a trusted network from an untrusted network. Firewalls determine which traffic should be allowed and which traffic should be disallowed based on a predetermined security policy.
Firewall systems designed to protect web applications are known. They are commonly implemented as application proxies or application gateways. An application proxy is an application program that runs on a firewall system between two networks and acts as an intermediary between a web client and a web server. When client requests are received at the firewall, the final server destination address is determined by the application proxy software. The application proxy translates the address, performs additional access control checking, and connects to the server on behalf of the client. An application proxy authenticates users and determines whether user requests are legitimate.
Two approaches for implementing application firewalls are known—a positive security model, which enforces positive behavior; and a negative security model, which blocks recognized attacks.
A negative security model blocks recognized attacks by relying on a database of expected attack signatures. This model operates similar to an anti-virus software and is referred to as a “blacklist” solution. All the incoming requests are compared against the known signatures. If a known attack is identified, the request is blocked. One downside of this approach is that a signature list needs to be always kept up-to-date. Otherwise, when a new request comes in that is not on the signature list, it will be passed to the server for processing. As a result, illegitimate traffic can get through.
A positive security model enforces positive behavior by learning the application logic and then building a security policy of valid known requests as a user interacts with the application. This approach explores all possible entry points, such as URLs, in a web application, and generates a set of allowable user actions for a particular application program. Messages that match some of the allowable actions are allowed. The rest of the messages are blocked. This solution is commonly referred to as a “whitelist” technique. One problem with this approach is that the generated list of allowable actions is static. As a result, when the application program changes, some of the rules become obsolete. In addition, certain situations, such as extensive use of JavaScript or deliberate deviations of the application from its usual behavior can generate a large number of false positives, i.e., illegitimately blocked messages. Since some of the blocked messages may represent legitimate requests rather than malicious attacks, the existing model blocks messages which may turn out to be legitimate.
Accordingly, what is needed is a web application security technique that generates exception rules to the rules that block legitimate traffic.